kernel: bump 6.6 to 6.6.35

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.35

Removed upstreamed:
	bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch[1]

Removed no longer needed:
	generic/pending-6.6/779-net-vxlan-don-t-learn-non-unicast-L2-destinations.patch[2]

All other patches automatically rebased.

Build system: x86/64
Build-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3
Run-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3

1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.35&id=52100fd74ad07b53a4666feafff1cd11436362d3
2. As suggested by @DragonBluep, "This patch can be removed. It will never return false. And the upstream commit should fix the same issue: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=v6.6.35&id=924f7bbfc5cfd029e417c56357ca01eae681fba6"

Signed-off-by: John Audia <therealgraysky@proton.me>

7 files changed, 13 insertions, 98 deletions

diff --git a/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch b/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
index 7876818c39..cbaf6ac1e2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
@@ -14,7 +14,7 @@ We don't agree with upstream revert so undo it.
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -479,8 +479,10 @@ static void xhci_pci_quirks(struct devic
+@@ -486,8 +486,10 @@ static void xhci_pci_quirks(struct devic
  			pdev->device == 0x3432)
  		xhci->quirks |= XHCI_BROKEN_STREAMS;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
index a454300558..f9fa454aeb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -52,7 +52,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1679,8 +1679,9 @@ struct urb_priv {
+@@ -1680,8 +1680,9 @@ struct urb_priv {
   * Each segment table entry is 4*32bits long.  1K seems like an ok size:
   * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
   * meaning 64 ring segments.
diff --git a/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch b/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
index 344e206df6..65d04a01ee 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
@@ -24,7 +24,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -482,6 +482,7 @@ static void xhci_pci_quirks(struct devic
+@@ -489,6 +489,7 @@ static void xhci_pci_quirks(struct devic
  	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
  		xhci->quirks |= XHCI_LPM_SUPPORT;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
@@ -52,7 +52,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	addr = xhci_trb_virt_to_dma(new_seg, new_deq);
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1914,6 +1914,9 @@ struct xhci_hcd {
+@@ -1915,6 +1915,9 @@ struct xhci_hcd {
  #define XHCI_ZHAOXIN_TRB_FETCH	BIT_ULL(45)
  #define XHCI_ZHAOXIN_HOST	BIT_ULL(46)
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch b/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
index 488629c334..fa7a10e316 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -483,6 +483,7 @@ static void xhci_pci_quirks(struct devic
+@@ -490,6 +490,7 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_LPM_SUPPORT;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch b/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
index 766b4f5bf1..ef0ef47969 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
@@ -90,7 +90,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* Allow 3 retries for everything but isoc, set CErr = 3 */
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -484,6 +484,7 @@ static void xhci_pci_quirks(struct devic
+@@ -491,6 +491,7 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
  		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
@@ -100,7 +100,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1916,6 +1916,7 @@ struct xhci_hcd {
+@@ -1917,6 +1917,7 @@ struct xhci_hcd {
  
  /* Downstream VLI fixes */
  #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
diff --git a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
index 97c88f8231..e1846dc8f5 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
@@ -47,7 +47,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* Device for a quirk */
  #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
  #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
-@@ -290,6 +292,16 @@ static int xhci_pci_reinit(struct xhci_h
+@@ -291,6 +293,16 @@ static int xhci_pci_reinit(struct xhci_h
  	return 0;
  }
  
@@ -64,7 +64,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
  {
  	struct pci_dev                  *pdev = to_pci_dev(dev);
-@@ -485,6 +497,8 @@ static void xhci_pci_quirks(struct devic
+@@ -492,6 +504,8 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
  		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
  		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
@@ -75,7 +75,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -3626,6 +3626,48 @@ static int xhci_align_td(struct xhci_hcd
+@@ -3657,6 +3657,48 @@ static int xhci_align_td(struct xhci_hcd
  	return 1;
  }
  
@@ -124,7 +124,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* This is very similar to what ehci-q.c qtd_fill() does */
  int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
  		struct urb *urb, int slot_id, unsigned int ep_index)
-@@ -3782,6 +3824,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+@@ -3813,6 +3855,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
  	}
  
  	check_trb_math(urb, enqd_len);
@@ -133,7 +133,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
  			start_cycle, start_trb);
  	return 0;
-@@ -3917,6 +3961,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+@@ -3948,6 +3992,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
  			/* Event on completion */
  			field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
  
@@ -144,7 +144,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return 0;
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1917,6 +1917,7 @@ struct xhci_hcd {
+@@ -1918,6 +1918,7 @@ struct xhci_hcd {
  /* Downstream VLI fixes */
  #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
  #define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(57)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch b/target/linux/bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch
deleted file mode 100644
index da945d2d05..0000000000
--- a/target/linux/bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 333b34fa4845022d563e83f01a60af0abd080679 Mon Sep 17 00:00:00 2001
-From: Lars Kellogg-Stedman <lars@oddbit.com>
-Date: Wed, 29 May 2024 17:02:43 -0400
-Subject: [PATCH 1135/1135] ax25: Fix refcount imbalance on inbound connections
-
-commit 3c34fb0bd4a4237592c5ecb5b2e2531900c55774 upstream.
-
-When releasing a socket in ax25_release(), we call netdev_put() to
-decrease the refcount on the associated ax.25 device. However, the
-execution path for accepting an incoming connection never calls
-netdev_hold(). This imbalance leads to refcount errors, and ultimately
-to kernel crashes.
-
-A typical call trace for the above situation will start with one of the
-following errors:
-
-    refcount_t: decrement hit 0; leaking memory.
-    refcount_t: underflow; use-after-free.
-
-And will then have a trace like:
-
-    Call Trace:
-    <TASK>
-    ? show_regs+0x64/0x70
-    ? __warn+0x83/0x120
-    ? refcount_warn_saturate+0xb2/0x100
-    ? report_bug+0x158/0x190
-    ? prb_read_valid+0x20/0x30
-    ? handle_bug+0x3e/0x70
-    ? exc_invalid_op+0x1c/0x70
-    ? asm_exc_invalid_op+0x1f/0x30
-    ? refcount_warn_saturate+0xb2/0x100
-    ? refcount_warn_saturate+0xb2/0x100
-    ax25_release+0x2ad/0x360
-    __sock_release+0x35/0xa0
-    sock_close+0x19/0x20
-    [...]
-
-On reboot (or any attempt to remove the interface), the kernel gets
-stuck in an infinite loop:
-
-    unregister_netdevice: waiting for ax0 to become free. Usage count = 0
-
-This patch corrects these issues by ensuring that we call netdev_hold()
-and ax25_dev_hold() for new connections in ax25_accept(). This makes the
-logic leading to ax25_accept() match the logic for ax25_bind(): in both
-cases we increment the refcount, which is ultimately decremented in
-ax25_release().
-
-Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
-Signed-off-by: Lars Kellogg-Stedman <lars@oddbit.com>
-Tested-by: Duoming Zhou <duoming@zju.edu.cn>
-Tested-by: Dan Cross <crossd@gmail.com>
-Tested-by: Chris Maness <christopher.maness@gmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/20240529210242.3346844-2-lars@oddbit.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
- net/ax25/af_ax25.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/net/ax25/af_ax25.c
-+++ b/net/ax25/af_ax25.c
-@@ -1378,8 +1378,10 @@ static int ax25_accept(struct socket *so
- {
- 	struct sk_buff *skb;
- 	struct sock *newsk;
-+	ax25_dev *ax25_dev;
- 	DEFINE_WAIT(wait);
- 	struct sock *sk;
-+	ax25_cb *ax25;
- 	int err = 0;
- 
- 	if (sock->state != SS_UNCONNECTED)
-@@ -1434,6 +1436,10 @@ static int ax25_accept(struct socket *so
- 	kfree_skb(skb);
- 	sk_acceptq_removed(sk);
- 	newsock->state = SS_CONNECTED;
-+	ax25 = sk_to_ax25(newsk);
-+	ax25_dev = ax25->ax25_dev;
-+	netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC);
-+	ax25_dev_hold(ax25_dev);
- 
- out:
- 	release_sock(sk);